projects / BearSSL / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
Added SHAKE implementation.
[BearSSL] / test / test_speed.c
1 /*
2 * Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
3 *
4 * Permission is hereby granted, free of charge, to any person obtaining
5 * a copy of this software and associated documentation files (the
6 * "Software"), to deal in the Software without restriction, including
7 * without limitation the rights to use, copy, modify, merge, publish,
8 * distribute, sublicense, and/or sell copies of the Software, and to
9 * permit persons to whom the Software is furnished to do so, subject to
10 * the following conditions:
11 *
12 * The above copyright notice and this permission notice shall be
13 * included in all copies or substantial portions of the Software.
14 *
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
19 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
20 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
21 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22 * SOFTWARE.
23 */
24
25 #include <stdio.h>
26 #include <stdlib.h>
27 #include <string.h>
28 #include <time.h>
29 #include "inner.h"
30
31 #define HASH_SIZE(cname) br_ ## cname ## _SIZE
32
33 #define SPEED_HASH(Name, cname) \
34 static void \
35 test_speed_ ## cname(void) \
36 { \
37 unsigned char buf[8192]; \
38 unsigned char tmp[HASH_SIZE(cname)]; \
39 br_ ## cname ## _context mc; \
40 int i; \
41 long num; \
42 \
43 memset(buf, 'T', sizeof buf); \
44 for (i = 0; i < 10; i ++) { \
45 br_ ## cname ## _init(&mc); \
46 br_ ## cname ## _update(&mc, buf, sizeof buf); \
47 br_ ## cname ## _out(&mc, tmp); \
48 } \
49 num = 10; \
50 for (;;) { \
51 clock_t begin, end; \
52 double tt; \
53 long k; \
54 \
55 br_ ## cname ## _init(&mc); \
56 begin = clock(); \
57 for (k = num; k > 0; k --) { \
58 br_ ## cname ## _update(&mc, buf, sizeof buf); \
59 } \
60 end = clock(); \
61 br_ ## cname ## _out(&mc, tmp); \
62 tt = (double)(end - begin) / CLOCKS_PER_SEC; \
63 if (tt >= 2.0) { \
64 printf("%-30s %8.2f MB/s\n", #Name, \
65 ((double)sizeof buf) * (double)num \
66 / (tt * 1000000.0)); \
67 fflush(stdout); \
68 return; \
69 } \
70 num <<= 1; \
71 } \
72 }
73
74 #define BLOCK_SIZE(cname) br_ ## cname ## _BLOCK_SIZE
75
76 #define SPEED_BLOCKCIPHER_CBC(Name, fname, cname, klen, dir) \
77 static void \
78 test_speed_ ## fname(void) \
79 { \
80 unsigned char key[klen]; \
81 unsigned char buf[8192 - (8192 % BLOCK_SIZE(cname))]; \
82 unsigned char iv[BLOCK_SIZE(cname)]; \
83 const br_block_cbc ## dir ## _class *vt; \
84 br_ ## cname ## _cbc ## dir ## _keys ec; \
85 int i; \
86 long num; \
87 \
88 memset(key, 'T', sizeof key); \
89 memset(buf, 'P', sizeof buf); \
90 memset(iv, 'X', sizeof iv); \
91 vt = br_ ## cname ## _cbc ## dir ## _get_vtable(); \
92 if (vt == NULL) { \
93 printf("%-30s UNAVAILABLE\n", #Name); \
94 fflush(stdout); \
95 return; \
96 } \
97 for (i = 0; i < 10; i ++) { \
98 vt->init(&ec.vtable, key, sizeof key); \
99 vt->run(&ec.vtable, iv, buf, sizeof buf); \
100 } \
101 num = 10; \
102 for (;;) { \
103 clock_t begin, end; \
104 double tt; \
105 long k; \
106 \
107 vt->init(&ec.vtable, key, sizeof key); \
108 begin = clock(); \
109 for (k = num; k > 0; k --) { \
110 vt->run(&ec.vtable, iv, buf, sizeof buf); \
111 } \
112 end = clock(); \
113 tt = (double)(end - begin) / CLOCKS_PER_SEC; \
114 if (tt >= 2.0) { \
115 printf("%-30s %8.2f MB/s\n", #Name, \
116 ((double)sizeof buf) * (double)num \
117 / (tt * 1000000.0)); \
118 fflush(stdout); \
119 return; \
120 } \
121 num <<= 1; \
122 } \
123 }
124
125 #define SPEED_BLOCKCIPHER_CTR(Name, fname, cname, klen) \
126 static void \
127 test_speed_ ## fname(void) \
128 { \
129 unsigned char key[klen]; \
130 unsigned char buf[8192 - (8192 % BLOCK_SIZE(cname))]; \
131 unsigned char iv[BLOCK_SIZE(cname) - 4]; \
132 const br_block_ctr_class *vt; \
133 br_ ## cname ## _ctr_keys ec; \
134 int i; \
135 long num; \
136 \
137 memset(key, 'T', sizeof key); \
138 memset(buf, 'P', sizeof buf); \
139 memset(iv, 'X', sizeof iv); \
140 vt = br_ ## cname ## _ctr_get_vtable(); \
141 if (vt == NULL) { \
142 printf("%-30s UNAVAILABLE\n", #Name); \
143 fflush(stdout); \
144 return; \
145 } \
146 for (i = 0; i < 10; i ++) { \
147 vt->init(&ec.vtable, key, sizeof key); \
148 vt->run(&ec.vtable, iv, 1, buf, sizeof buf); \
149 } \
150 num = 10; \
151 for (;;) { \
152 clock_t begin, end; \
153 double tt; \
154 long k; \
155 \
156 vt->init(&ec.vtable, key, sizeof key); \
157 begin = clock(); \
158 for (k = num; k > 0; k --) { \
159 vt->run(&ec.vtable, iv, 1, buf, sizeof buf); \
160 } \
161 end = clock(); \
162 tt = (double)(end - begin) / CLOCKS_PER_SEC; \
163 if (tt >= 2.0) { \
164 printf("%-30s %8.2f MB/s\n", #Name, \
165 ((double)sizeof buf) * (double)num \
166 / (tt * 1000000.0)); \
167 fflush(stdout); \
168 return; \
169 } \
170 num <<= 1; \
171 } \
172 }
173
174 #define SPEED_CHACHA20(Name, fname) \
175 static void \
176 test_speed_ ## fname(void) \
177 { \
178 br_chacha20_run bc; \
179 unsigned char key[32]; \
180 unsigned char buf[8192]; \
181 unsigned char iv[12]; \
182 int i; \
183 long num; \
184 \
185 bc = br_ ## fname ## _get(); \
186 if (bc == 0) { \
187 printf("%-30s UNAVAILABLE\n", #Name); \
188 fflush(stdout); \
189 return; \
190 } \
191 memset(key, 'T', sizeof key); \
192 memset(buf, 'P', sizeof buf); \
193 memset(iv, 'X', sizeof iv); \
194 for (i = 0; i < 10; i ++) { \
195 bc(key, iv, i, buf, sizeof buf); \
196 } \
197 num = 10; \
198 for (;;) { \
199 clock_t begin, end; \
200 double tt; \
201 long k; \
202 \
203 begin = clock(); \
204 for (k = num; k > 0; k --) { \
205 bc(key, iv, (uint32_t)k, buf, sizeof buf); \
206 } \
207 end = clock(); \
208 tt = (double)(end - begin) / CLOCKS_PER_SEC; \
209 if (tt >= 2.0) { \
210 printf("%-30s %8.2f MB/s\n", #Name, \
211 ((double)sizeof buf) * (double)num \
212 / (tt * 1000000.0)); \
213 fflush(stdout); \
214 return; \
215 } \
216 num <<= 1; \
217 } \
218 }
219
220 SPEED_HASH(MD5, md5)
221 SPEED_HASH(SHA-1, sha1)
222 SPEED_HASH(SHA-256, sha256)
223 SPEED_HASH(SHA-512, sha512)
224
225 /*
226 * There are no vtable selection functions for the portable implementations,
227 * so we define some custom macros.
228 */
229 #define br_aes_big_cbcenc_get_vtable() (&br_aes_big_cbcenc_vtable)
230 #define br_aes_big_cbcdec_get_vtable() (&br_aes_big_cbcdec_vtable)
231 #define br_aes_big_ctr_get_vtable() (&br_aes_big_ctr_vtable)
232 #define br_aes_big_ctrcbc_get_vtable() (&br_aes_big_ctrcbc_vtable)
233 #define br_aes_small_cbcenc_get_vtable() (&br_aes_small_cbcenc_vtable)
234 #define br_aes_small_cbcdec_get_vtable() (&br_aes_small_cbcdec_vtable)
235 #define br_aes_small_ctr_get_vtable() (&br_aes_small_ctr_vtable)
236 #define br_aes_small_ctrcbc_get_vtable() (&br_aes_small_ctrcbc_vtable)
237 #define br_aes_ct_cbcenc_get_vtable() (&br_aes_ct_cbcenc_vtable)
238 #define br_aes_ct_cbcdec_get_vtable() (&br_aes_ct_cbcdec_vtable)
239 #define br_aes_ct_ctr_get_vtable() (&br_aes_ct_ctr_vtable)
240 #define br_aes_ct_ctrcbc_get_vtable() (&br_aes_ct_ctrcbc_vtable)
241 #define br_aes_ct64_cbcenc_get_vtable() (&br_aes_ct64_cbcenc_vtable)
242 #define br_aes_ct64_cbcdec_get_vtable() (&br_aes_ct64_cbcdec_vtable)
243 #define br_aes_ct64_ctr_get_vtable() (&br_aes_ct64_ctr_vtable)
244 #define br_aes_ct64_ctrcbc_get_vtable() (&br_aes_ct64_ctrcbc_vtable)
245 #define br_chacha20_ct_get() (&br_chacha20_ct_run)
246
247 #define SPEED_AES(iname) \
248 SPEED_BLOCKCIPHER_CBC(AES-128 CBC encrypt (iname), aes128_ ## iname ## _cbcenc, aes_ ## iname, 16, enc) \
249 SPEED_BLOCKCIPHER_CBC(AES-128 CBC decrypt (iname), aes128_ ## iname ## _cbcdec, aes_ ## iname, 16, dec) \
250 SPEED_BLOCKCIPHER_CBC(AES-192 CBC encrypt (iname), aes192_ ## iname ## _cbcenc, aes_ ## iname, 24, enc) \
251 SPEED_BLOCKCIPHER_CBC(AES-192 CBC decrypt (iname), aes192_ ## iname ## _cbcdec, aes_ ## iname, 24, dec) \
252 SPEED_BLOCKCIPHER_CBC(AES-256 CBC encrypt (iname), aes256_ ## iname ## _cbcenc, aes_ ## iname, 32, enc) \
253 SPEED_BLOCKCIPHER_CBC(AES-256 CBC decrypt (iname), aes256_ ## iname ## _cbcdec, aes_ ## iname, 32, dec) \
254 SPEED_BLOCKCIPHER_CTR(AES-128 CTR (iname), aes128_ ## iname ## _ctr, aes_ ## iname, 16) \
255 SPEED_BLOCKCIPHER_CTR(AES-192 CTR (iname), aes192_ ## iname ## _ctr, aes_ ## iname, 24) \
256 SPEED_BLOCKCIPHER_CTR(AES-256 CTR (iname), aes256_ ## iname ## _ctr, aes_ ## iname, 32)
257
258 SPEED_AES(big)
259 SPEED_AES(small)
260 SPEED_AES(ct)
261 SPEED_AES(ct64)
262 SPEED_AES(x86ni)
263 SPEED_AES(pwr8)
264
265 #define br_des_tab_cbcenc_get_vtable() (&br_des_tab_cbcenc_vtable)
266 #define br_des_tab_cbcdec_get_vtable() (&br_des_tab_cbcdec_vtable)
267 #define br_des_ct_cbcenc_get_vtable() (&br_des_ct_cbcenc_vtable)
268 #define br_des_ct_cbcdec_get_vtable() (&br_des_ct_cbcdec_vtable)
269
270 #define SPEED_DES(iname) \
271 SPEED_BLOCKCIPHER_CBC(DES CBC encrypt (iname), des_ ## iname ## _cbcenc, des_ ## iname, 8, enc) \
272 SPEED_BLOCKCIPHER_CBC(DES CBC decrypt (iname), des_ ## iname ## _cbcdec, des_ ## iname, 8, dec) \
273 SPEED_BLOCKCIPHER_CBC(3DES CBC encrypt (iname), 3des_ ## iname ## _cbcenc, des_ ## iname, 24, enc) \
274 SPEED_BLOCKCIPHER_CBC(3DES CBC decrypt (iname), 3des_ ## iname ## _cbcdec, des_ ## iname, 24, dec)
275
276 SPEED_DES(tab)
277 SPEED_DES(ct)
278
279 SPEED_CHACHA20(ChaCha20 (ct), chacha20_ct)
280 SPEED_CHACHA20(ChaCha20 (sse2), chacha20_sse2)
281
282 static void
283 test_speed_ghash_inner(char *name, br_ghash gh)
284 {
285 unsigned char buf[8192], h[16], y[16];
286 int i;
287 long num;
288
289 memset(buf, 'T', sizeof buf);
290 memset(h, 'P', sizeof h);
291 memset(y, 0, sizeof y);
292 for (i = 0; i < 10; i ++) {
293 gh(y, h, buf, sizeof buf);
294 }
295 num = 10;
296 for (;;) {
297 clock_t begin, end;
298 double tt;
299 long k;
300
301 begin = clock();
302 for (k = num; k > 0; k --) {
303 gh(y, h, buf, sizeof buf);
304 }
305 end = clock();
306 tt = (double)(end - begin) / CLOCKS_PER_SEC;
307 if (tt >= 2.0) {
308 printf("%-30s %8.2f MB/s\n", name,
309 ((double)sizeof buf) * (double)num
310 / (tt * 1000000.0));
311 fflush(stdout);
312 return;
313 }
314 num <<= 1;
315 }
316 }
317
318 static void
319 test_speed_ghash_ctmul(void)
320 {
321 test_speed_ghash_inner("GHASH (ctmul)", &br_ghash_ctmul);
322 }
323
324 static void
325 test_speed_ghash_ctmul32(void)
326 {
327 test_speed_ghash_inner("GHASH (ctmul32)", &br_ghash_ctmul32);
328 }
329
330 static void
331 test_speed_ghash_ctmul64(void)
332 {
333 test_speed_ghash_inner("GHASH (ctmul64)", &br_ghash_ctmul64);
334 }
335
336 static void
337 test_speed_ghash_pclmul(void)
338 {
339 br_ghash gh;
340
341 gh = br_ghash_pclmul_get();
342 if (gh == 0) {
343 printf("%-30s UNAVAILABLE\n", "GHASH (pclmul)");
344 fflush(stdout);
345 } else {
346 test_speed_ghash_inner("GHASH (pclmul)", gh);
347 }
348 }
349
350 static void
351 test_speed_ghash_pwr8(void)
352 {
353 br_ghash gh;
354
355 gh = br_ghash_pwr8_get();
356 if (gh == 0) {
357 printf("%-30s UNAVAILABLE\n", "GHASH (pwr8)");
358 fflush(stdout);
359 } else {
360 test_speed_ghash_inner("GHASH (pwr8)", gh);
361 }
362 }
363
364 static uint32_t
365 fake_chacha20(const void *key, const void *iv,
366 uint32_t cc, void *data, size_t len)
367 {
368 (void)key;
369 (void)iv;
370 (void)data;
371 (void)len;
372 return cc + (uint32_t)((len + 63) >> 6);
373 }
374
375 /*
376 * To speed-test Poly1305, we run it with a do-nothing stub instead of
377 * ChaCha20.
378 */
379 static void
380 test_speed_poly1305_inner(char *name, br_poly1305_run pl)
381 {
382 unsigned char buf[8192], key[32], iv[12], aad[13], tag[16];
383 int i;
384 long num;
385
386 memset(key, 'K', sizeof key);
387 memset(iv, 'I', sizeof iv);
388 memset(aad, 'A', sizeof aad);
389 memset(buf, 'T', sizeof buf);
390 for (i = 0; i < 10; i ++) {
391 pl(key, iv, buf, sizeof buf,
392 aad, sizeof aad, tag, &fake_chacha20, 0);
393 }
394 num = 10;
395 for (;;) {
396 clock_t begin, end;
397 double tt;
398 long k;
399
400 begin = clock();
401 for (k = num; k > 0; k --) {
402 pl(key, iv, buf, sizeof buf,
403 aad, sizeof aad, tag, &fake_chacha20, 0);
404 }
405 end = clock();
406 tt = (double)(end - begin) / CLOCKS_PER_SEC;
407 if (tt >= 2.0) {
408 printf("%-30s %8.2f MB/s\n", name,
409 ((double)sizeof buf) * (double)num
410 / (tt * 1000000.0));
411 fflush(stdout);
412 return;
413 }
414 num <<= 1;
415 }
416 }
417
418 static void
419 test_speed_poly1305_ctmul(void)
420 {
421 test_speed_poly1305_inner("Poly1305 (ctmul)", &br_poly1305_ctmul_run);
422 }
423
424 static void
425 test_speed_poly1305_ctmul32(void)
426 {
427 test_speed_poly1305_inner("Poly1305 (ctmul32)",
428 &br_poly1305_ctmul32_run);
429 }
430
431 static void
432 test_speed_poly1305_ctmulq(void)
433 {
434 br_poly1305_run bp;
435
436 bp = br_poly1305_ctmulq_get();
437 if (bp == 0) {
438 printf("%-30s UNAVAILABLE\n", "Poly1305 (ctmulq)");
439 } else {
440 test_speed_poly1305_inner("Poly1305 (ctmulq)", bp);
441 }
442 }
443
444 static void
445 test_speed_poly1305_i15(void)
446 {
447 test_speed_poly1305_inner("Poly1305 (i15)", &br_poly1305_i15_run);
448 }
449
450 static void
451 test_speed_eax_inner(char *name,
452 const br_block_ctrcbc_class *vt, size_t key_len)
453 {
454 unsigned char buf[8192], key[32], nonce[16], aad[16], tag[16];
455 int i;
456 long num;
457 br_aes_gen_ctrcbc_keys ac;
458 br_eax_context ec;
459
460 if (vt == NULL) {
461 printf("%-30s UNAVAILABLE\n", name);
462 fflush(stdout);
463 return;
464 }
465 memset(key, 'K', key_len);
466 memset(nonce, 'N', sizeof nonce);
467 memset(aad, 'A', sizeof aad);
468 memset(buf, 'T', sizeof buf);
469 for (i = 0; i < 10; i ++) {
470 vt->init(&ac.vtable, key, key_len);
471 br_eax_init(&ec, &ac.vtable);
472 br_eax_reset(&ec, nonce, sizeof nonce);
473 br_eax_aad_inject(&ec, aad, sizeof aad);
474 br_eax_flip(&ec);
475 br_eax_run(&ec, 1, buf, sizeof buf);
476 br_eax_get_tag(&ec, tag);
477 }
478 num = 10;
479 for (;;) {
480 clock_t begin, end;
481 double tt;
482 long k;
483
484 begin = clock();
485 for (k = num; k > 0; k --) {
486 vt->init(&ac.vtable, key, key_len);
487 br_eax_init(&ec, &ac.vtable);
488 br_eax_reset(&ec, nonce, sizeof nonce);
489 br_eax_aad_inject(&ec, aad, sizeof aad);
490 br_eax_flip(&ec);
491 br_eax_run(&ec, 1, buf, sizeof buf);
492 br_eax_get_tag(&ec, tag);
493 }
494 end = clock();
495 tt = (double)(end - begin) / CLOCKS_PER_SEC;
496 if (tt >= 2.0) {
497 printf("%-30s %8.2f MB/s\n", name,
498 ((double)sizeof buf) * (double)num
499 / (tt * 1000000.0));
500 fflush(stdout);
501 return;
502 }
503 num <<= 1;
504 }
505 }
506
507 #define SPEED_EAX(Algo, algo, keysize, impl) \
508 static void \
509 test_speed_eax_ ## algo ## keysize ## _ ## impl(void) \
510 { \
511 test_speed_eax_inner("EAX " #Algo "-" #keysize "(" #impl ")", \
512 br_ ## algo ## _ ## impl ## _ctrcbc_get_vtable() \
513 , (keysize) >> 3); \
514 }
515
516 SPEED_EAX(AES, aes, 128, big)
517 SPEED_EAX(AES, aes, 128, small)
518 SPEED_EAX(AES, aes, 128, ct)
519 SPEED_EAX(AES, aes, 128, ct64)
520 SPEED_EAX(AES, aes, 128, x86ni)
521 SPEED_EAX(AES, aes, 128, pwr8)
522 SPEED_EAX(AES, aes, 192, big)
523 SPEED_EAX(AES, aes, 192, small)
524 SPEED_EAX(AES, aes, 192, ct)
525 SPEED_EAX(AES, aes, 192, ct64)
526 SPEED_EAX(AES, aes, 192, x86ni)
527 SPEED_EAX(AES, aes, 192, pwr8)
528 SPEED_EAX(AES, aes, 256, big)
529 SPEED_EAX(AES, aes, 256, small)
530 SPEED_EAX(AES, aes, 256, ct)
531 SPEED_EAX(AES, aes, 256, ct64)
532 SPEED_EAX(AES, aes, 256, x86ni)
533 SPEED_EAX(AES, aes, 256, pwr8)
534
535 static void
536 test_speed_shake_inner(int security_level)
537 {
538 unsigned char buf[8192];
539 br_shake_context sc;
540 int i;
541 long num;
542
543 memset(buf, 'D', sizeof buf);
544 br_shake_init(&sc, security_level);
545 for (i = 0; i < 10; i ++) {
546 br_shake_inject(&sc, buf, sizeof buf);
547 }
548 num = 10;
549 for (;;) {
550 clock_t begin, end;
551 double tt;
552 long k;
553
554 begin = clock();
555 for (k = num; k > 0; k --) {
556 br_shake_inject(&sc, buf, sizeof buf);
557 }
558 end = clock();
559 tt = (double)(end - begin) / CLOCKS_PER_SEC;
560 if (tt >= 2.0) {
561 printf("SHAKE%-3d (inject) %8.2f MB/s\n",
562 security_level,
563 ((double)sizeof buf) * (double)num
564 / (tt * 1000000.0));
565 fflush(stdout);
566 break;
567 }
568 num <<= 1;
569 }
570
571 br_shake_flip(&sc);
572 for (i = 0; i < 10; i ++) {
573 br_shake_produce(&sc, buf, sizeof buf);
574 }
575
576 num = 10;
577 for (;;) {
578 clock_t begin, end;
579 double tt;
580 long k;
581
582 begin = clock();
583 for (k = num; k > 0; k --) {
584 br_shake_produce(&sc, buf, sizeof buf);
585 }
586 end = clock();
587 tt = (double)(end - begin) / CLOCKS_PER_SEC;
588 if (tt >= 2.0) {
589 printf("SHAKE%-3d (produce) %8.2f MB/s\n",
590 security_level,
591 ((double)sizeof buf) * (double)num
592 / (tt * 1000000.0));
593 fflush(stdout);
594 break;
595 }
596 num <<= 1;
597 }
598 }
599
600 static void
601 test_speed_shake128(void)
602 {
603 test_speed_shake_inner(128);
604 }
605
606 static void
607 test_speed_shake256(void)
608 {
609 test_speed_shake_inner(256);
610 }
611
612 static const unsigned char RSA_N[] = {
613 0xE9, 0xF2, 0x4A, 0x2F, 0x96, 0xDF, 0x0A, 0x23,
614 0x01, 0x85, 0xF1, 0x2C, 0xB2, 0xA8, 0xEF, 0x23,
615 0xCE, 0x2E, 0xB0, 0x4E, 0x18, 0x31, 0x95, 0x5B,
616 0x98, 0x2D, 0x9B, 0x8C, 0xE3, 0x1A, 0x2B, 0x96,
617 0xB5, 0xC7, 0xEE, 0xED, 0x72, 0x43, 0x2D, 0xFE,
618 0x7F, 0x61, 0x33, 0xEA, 0x14, 0xFC, 0xDE, 0x80,
619 0x17, 0x42, 0xF0, 0xF3, 0xC3, 0xC7, 0x89, 0x47,
620 0x76, 0x5B, 0xFA, 0x33, 0xC4, 0x8C, 0x94, 0xDE,
621 0x6A, 0x75, 0xD8, 0x1A, 0xF4, 0x49, 0xBC, 0xF3,
622 0xB7, 0x9E, 0x2C, 0x8D, 0xEC, 0x5A, 0xEE, 0xBF,
623 0x4B, 0x5A, 0x7F, 0xEF, 0x21, 0x39, 0xDB, 0x1D,
624 0x83, 0x5E, 0x7E, 0x2F, 0xAA, 0x5E, 0xBA, 0x28,
625 0xC3, 0xA2, 0x53, 0x19, 0xFB, 0x2F, 0x78, 0x6B,
626 0x14, 0x60, 0x49, 0x3C, 0xCC, 0x1B, 0xE9, 0x1E,
627 0x3D, 0x10, 0xA4, 0xEB, 0x7F, 0x66, 0x98, 0xF6,
628 0xC3, 0xAC, 0x35, 0xF5, 0x01, 0x84, 0xFF, 0x7D,
629 0x1F, 0x72, 0xBE, 0xB4, 0xD1, 0x89, 0xC8, 0xDD,
630 0x44, 0xE7, 0xB5, 0x2E, 0x2C, 0xE1, 0x85, 0xF5,
631 0x15, 0x50, 0xA9, 0x08, 0xC7, 0x67, 0xD9, 0x2B,
632 0x6C, 0x11, 0xB3, 0xEB, 0x28, 0x8D, 0xF4, 0xCC,
633 0xE3, 0xC3, 0xC5, 0x04, 0x0E, 0x7C, 0x8D, 0xDB,
634 0x39, 0x06, 0x6A, 0x74, 0x75, 0xDF, 0xA8, 0x0F,
635 0xDA, 0x67, 0x5A, 0x73, 0x1E, 0xFD, 0x8E, 0x4C,
636 0xEE, 0x17, 0xEE, 0x1E, 0x67, 0xDB, 0x98, 0x70,
637 0x60, 0xF7, 0xB9, 0xB5, 0x1F, 0x19, 0x93, 0xD6,
638 0x3F, 0x2F, 0x1F, 0xB6, 0x5B, 0x59, 0xAA, 0x85,
639 0xBB, 0x25, 0xE4, 0x13, 0xEF, 0xE7, 0xB9, 0x87,
640 0x9C, 0x3F, 0x5E, 0xE4, 0x08, 0xA3, 0x51, 0xCF,
641 0x8B, 0xAD, 0xF4, 0xE6, 0x1A, 0x5F, 0x51, 0xDD,
642 0xA8, 0xBE, 0xE8, 0xD1, 0x20, 0x19, 0x61, 0x6C,
643 0x18, 0xAB, 0xCA, 0x0A, 0xD9, 0x82, 0xA6, 0x94,
644 0xD5, 0x69, 0x2A, 0xF6, 0x43, 0x66, 0x31, 0x09
645 };
646
647 static const unsigned char RSA_E[] = {
648 0x01, 0x00, 0x01
649 };
650
651 static const unsigned char RSA_P[] = {
652 0xFD, 0x39, 0x40, 0x56, 0x20, 0x80, 0xC5, 0x81,
653 0x4C, 0x5F, 0x0C, 0x1A, 0x52, 0x84, 0x03, 0x2F,
654 0xCE, 0x82, 0xB0, 0xD8, 0x30, 0x23, 0x7F, 0x77,
655 0x45, 0xC2, 0x01, 0xC4, 0x68, 0x96, 0x0D, 0xA7,
656 0x22, 0xA9, 0x6C, 0xA9, 0x1A, 0x33, 0xE5, 0x2F,
657 0xB5, 0x07, 0x9A, 0xF9, 0xEA, 0x33, 0xA5, 0xC8,
658 0x96, 0x60, 0x6A, 0xCA, 0xEB, 0xE5, 0x6E, 0x09,
659 0x46, 0x7E, 0x2D, 0xEF, 0x93, 0x7D, 0x56, 0xED,
660 0x75, 0x70, 0x3B, 0x96, 0xC4, 0xD5, 0xDB, 0x0B,
661 0x3F, 0x69, 0xDF, 0x06, 0x18, 0x76, 0xF4, 0xCF,
662 0xF8, 0x84, 0x22, 0xDF, 0xBD, 0x71, 0x62, 0x7B,
663 0x67, 0x99, 0xBC, 0x09, 0x95, 0x54, 0xA4, 0x98,
664 0x83, 0xF5, 0xA9, 0xCF, 0x09, 0xA5, 0x1F, 0x61,
665 0x25, 0xB4, 0x70, 0x6C, 0x91, 0xB8, 0xB3, 0xD0,
666 0xCE, 0x9C, 0x45, 0x65, 0x9B, 0xEF, 0xD4, 0x70,
667 0xBE, 0x86, 0xD2, 0x98, 0x5D, 0xEB, 0xE3, 0xFF
668 };
669
670 static const unsigned char RSA_Q[] = {
671 0xEC, 0x82, 0xEE, 0x63, 0x5F, 0x40, 0x52, 0xDB,
672 0x38, 0x7A, 0x37, 0x6A, 0x54, 0x5B, 0xD9, 0xA0,
673 0x73, 0xB4, 0xBB, 0x52, 0xB2, 0x84, 0x07, 0xD0,
674 0xCC, 0x82, 0x0D, 0x20, 0xB3, 0xFA, 0xD5, 0xB6,
675 0x25, 0x92, 0x35, 0x4D, 0xB4, 0xC7, 0x36, 0x48,
676 0xCE, 0x5E, 0x21, 0x4A, 0xA6, 0x74, 0x65, 0xF4,
677 0x7D, 0x1D, 0xBC, 0x3B, 0xE2, 0xF4, 0x3E, 0x11,
678 0x58, 0x10, 0x6C, 0x04, 0x46, 0x9E, 0x8D, 0x57,
679 0xE0, 0x04, 0xE2, 0xEC, 0x47, 0xCF, 0xB3, 0x2A,
680 0xFD, 0x4C, 0x55, 0x18, 0xDB, 0xDE, 0x3B, 0xDC,
681 0xF4, 0x5B, 0xDA, 0xF3, 0x1A, 0xC8, 0x41, 0x6F,
682 0x73, 0x3B, 0xFE, 0x3C, 0xA0, 0xDB, 0xBA, 0x6E,
683 0x65, 0xA5, 0xE8, 0x02, 0xA5, 0x6C, 0xEA, 0x03,
684 0xF6, 0x99, 0xF7, 0xCB, 0x4B, 0xB7, 0x11, 0x51,
685 0x93, 0x88, 0x3F, 0xF9, 0x06, 0x85, 0xA9, 0x1E,
686 0xCA, 0x64, 0xF8, 0x11, 0xA5, 0x1A, 0xCA, 0xF7
687 };
688
689 static const unsigned char RSA_DP[] = {
690 0x77, 0x95, 0xE0, 0x02, 0x4C, 0x9B, 0x43, 0xAA,
691 0xCA, 0x4C, 0x60, 0xC4, 0xD5, 0x8F, 0x2E, 0x8A,
692 0x17, 0x36, 0xB5, 0x19, 0x83, 0xB2, 0x5F, 0xF2,
693 0x0D, 0xE9, 0x8F, 0x38, 0x18, 0x44, 0x34, 0xF2,
694 0x67, 0x76, 0x27, 0xB0, 0xBC, 0x85, 0x21, 0x89,
695 0x24, 0x2F, 0x11, 0x4B, 0x51, 0x05, 0x4F, 0x17,
696 0xA9, 0x9C, 0xA3, 0x12, 0x6D, 0xD1, 0x0D, 0xE4,
697 0x27, 0x7C, 0x53, 0x69, 0x3E, 0xF8, 0x04, 0x63,
698 0x64, 0x00, 0xBA, 0xC3, 0x7A, 0xF5, 0x9B, 0xDA,
699 0x75, 0xFA, 0x23, 0xAF, 0x17, 0x42, 0xA6, 0x5E,
700 0xC8, 0xF8, 0x6E, 0x17, 0xC7, 0xB9, 0x92, 0x4E,
701 0xC1, 0x20, 0x63, 0x23, 0x0B, 0x78, 0xCB, 0xBA,
702 0x93, 0x27, 0x23, 0x28, 0x79, 0x5F, 0x97, 0xB0,
703 0x23, 0x44, 0x51, 0x8B, 0x94, 0x4D, 0xEB, 0xED,
704 0x82, 0x85, 0x5E, 0x68, 0x9B, 0xF9, 0xE9, 0x13,
705 0xCD, 0x86, 0x92, 0x52, 0x0E, 0x98, 0xE6, 0x35
706 };
707
708 static const unsigned char RSA_DQ[] = {
709 0xD8, 0xDD, 0x71, 0xB3, 0x62, 0xBA, 0xBB, 0x7E,
710 0xD1, 0xF9, 0x96, 0xE8, 0x83, 0xB3, 0xB9, 0x08,
711 0x9C, 0x30, 0x03, 0x77, 0xDF, 0xC2, 0x9A, 0xDC,
712 0x05, 0x39, 0xD6, 0xC9, 0xBE, 0xDE, 0x68, 0xA9,
713 0xDD, 0x27, 0x84, 0x82, 0xDD, 0x19, 0xB1, 0x97,
714 0xEE, 0xCA, 0x77, 0x22, 0x59, 0x20, 0xEF, 0xFF,
715 0xCF, 0xDD, 0xBD, 0x24, 0xF8, 0x84, 0xD6, 0x88,
716 0xD6, 0xC4, 0x30, 0x17, 0x77, 0x9D, 0x98, 0xA3,
717 0x14, 0x01, 0xC7, 0x05, 0xBB, 0x0F, 0x23, 0x0D,
718 0x6F, 0x37, 0x57, 0xEC, 0x34, 0x67, 0x41, 0x62,
719 0xE8, 0x19, 0x75, 0xD9, 0x66, 0x1C, 0x6B, 0x8B,
720 0xC3, 0x11, 0x26, 0x9C, 0xF7, 0x2E, 0xA3, 0x72,
721 0xE8, 0xF7, 0xC8, 0x96, 0xEC, 0x92, 0xC2, 0xBD,
722 0xA1, 0x98, 0x2A, 0x93, 0x99, 0xB8, 0xA2, 0x43,
723 0xB7, 0xD0, 0xBE, 0x40, 0x1C, 0x8F, 0xE0, 0xB4,
724 0x20, 0x07, 0x97, 0x43, 0xAE, 0xAD, 0xB3, 0x9F
725 };
726
727 static const unsigned char RSA_IQ[] = {
728 0xB7, 0xE2, 0x60, 0xA9, 0x62, 0xEC, 0xEC, 0x0B,
729 0x57, 0x02, 0x96, 0xF9, 0x36, 0x35, 0x2C, 0x37,
730 0xAF, 0xC2, 0xEE, 0x71, 0x49, 0x26, 0x8E, 0x0F,
731 0x27, 0xB1, 0xFA, 0x0F, 0xEA, 0xDC, 0xF0, 0x8B,
732 0x53, 0x6C, 0xB2, 0x46, 0x27, 0xCD, 0x29, 0xA2,
733 0x35, 0x0F, 0x5D, 0x8A, 0x3F, 0x20, 0x8C, 0x13,
734 0x3D, 0xA1, 0xFF, 0x85, 0x91, 0x99, 0xE8, 0x50,
735 0xED, 0xF1, 0x29, 0x00, 0xEE, 0x24, 0x90, 0xB5,
736 0x5F, 0x3A, 0x74, 0x26, 0xD7, 0xA2, 0x24, 0x8D,
737 0x89, 0x88, 0xD8, 0x35, 0x22, 0x22, 0x8A, 0x66,
738 0x5D, 0x5C, 0xDE, 0x83, 0x8C, 0xFA, 0x27, 0xE6,
739 0xB9, 0xEB, 0x72, 0x08, 0xCD, 0x53, 0x4B, 0x93,
740 0x0F, 0xAD, 0xC3, 0xF8, 0x7C, 0xFE, 0x84, 0xD7,
741 0x08, 0xF3, 0xBE, 0x3D, 0x60, 0x1E, 0x95, 0x8D,
742 0x44, 0x5B, 0x65, 0x7E, 0xC1, 0x30, 0xC3, 0x84,
743 0xC0, 0xB0, 0xFE, 0xBF, 0x28, 0x54, 0x1E, 0xC4
744 };
745
746 static const br_rsa_public_key RSA_PK = {
747 (void *)RSA_N, sizeof RSA_N,
748 (void *)RSA_E, sizeof RSA_E
749 };
750
751 static const br_rsa_private_key RSA_SK = {
752 2048,
753 (void *)RSA_P, sizeof RSA_P,
754 (void *)RSA_Q, sizeof RSA_Q,
755 (void *)RSA_DP, sizeof RSA_DP,
756 (void *)RSA_DQ, sizeof RSA_DQ,
757 (void *)RSA_IQ, sizeof RSA_IQ
758 };
759
760 static void
761 test_speed_rsa_inner(char *name,
762 br_rsa_public fpub, br_rsa_private fpriv, br_rsa_keygen kgen)
763 {
764 unsigned char tmp[sizeof RSA_N];
765 int i;
766 long num;
767 /*
768 br_hmac_drbg_context rng;
769 */
770 br_aesctr_drbg_context rng;
771 const br_block_ctr_class *ictr;
772
773 memset(tmp, 'R', sizeof tmp);
774 tmp[0] = 0;
775 for (i = 0; i < 10; i ++) {
776 if (!fpriv(tmp, &RSA_SK)) {
777 abort();
778 }
779 }
780 num = 10;
781 for (;;) {
782 clock_t begin, end;
783 double tt;
784 long k;
785
786 begin = clock();
787 for (k = num; k > 0; k --) {
788 fpriv(tmp, &RSA_SK);
789 }
790 end = clock();
791 tt = (double)(end - begin) / CLOCKS_PER_SEC;
792 if (tt >= 2.0) {
793 printf("%-30s %8.2f priv/s\n", name,
794 (double)num / tt);
795 fflush(stdout);
796 break;
797 }
798 num <<= 1;
799 }
800 for (i = 0; i < 10; i ++) {
801 if (!fpub(tmp, sizeof tmp, &RSA_PK)) {
802 abort();
803 }
804 }
805 num = 10;
806 for (;;) {
807 clock_t begin, end;
808 double tt;
809 long k;
810
811 begin = clock();
812 for (k = num; k > 0; k --) {
813 fpub(tmp, sizeof tmp, &RSA_PK);
814 }
815 end = clock();
816 tt = (double)(end - begin) / CLOCKS_PER_SEC;
817 if (tt >= 2.0) {
818 printf("%-30s %8.2f pub/s\n", name,
819 (double)num / tt);
820 fflush(stdout);
821 break;
822 }
823 num <<= 1;
824 }
825
826 if (kgen == 0) {
827 printf("%-30s KEYGEN UNAVAILABLE\n", name);
828 fflush(stdout);
829 return;
830 }
831 /*
832 br_hmac_drbg_init(&rng, &br_sha256_vtable, "RSA keygen seed", 15);
833 */
834 ictr = br_aes_x86ni_ctr_get_vtable();
835 if (ictr == NULL) {
836 ictr = br_aes_pwr8_ctr_get_vtable();
837 if (ictr == NULL) {
838 #if BR_64
839 ictr = &br_aes_ct64_ctr_vtable;
840 #else
841 ictr = &br_aes_ct_ctr_vtable;
842 #endif
843 }
844 }
845 br_aesctr_drbg_init(&rng, ictr, "RSA keygen seed", 15);
846
847 num = 10;
848 for (;;) {
849 clock_t begin, end;
850 double tt;
851 long k;
852
853 begin = clock();
854 for (k = num; k > 0; k --) {
855 br_rsa_private_key sk;
856 unsigned char kbuf[BR_RSA_KBUF_PRIV_SIZE(1024)];
857
858 kgen(&rng.vtable, &sk, kbuf, NULL, NULL, 1024, 0);
859 }
860 end = clock();
861 tt = (double)(end - begin) / CLOCKS_PER_SEC;
862 if (tt >= 10.0) {
863 printf("%-30s %8.2f kgen[1024]/s\n", name,
864 (double)num / tt);
865 fflush(stdout);
866 break;
867 }
868 num <<= 1;
869 }
870
871 num = 10;
872 for (;;) {
873 clock_t begin, end;
874 double tt;
875 long k;
876
877 begin = clock();
878 for (k = num; k > 0; k --) {
879 br_rsa_private_key sk;
880 unsigned char kbuf[BR_RSA_KBUF_PRIV_SIZE(2048)];
881
882 kgen(&rng.vtable, &sk, kbuf, NULL, NULL, 2048, 0);
883 }
884 end = clock();
885 tt = (double)(end - begin) / CLOCKS_PER_SEC;
886 if (tt >= 10.0) {
887 printf("%-30s %8.2f kgen[2048]/s\n", name,
888 (double)num / tt);
889 fflush(stdout);
890 break;
891 }
892 num <<= 1;
893 }
894 }
895
896 static void
897 test_speed_rsa_i15(void)
898 {
899 test_speed_rsa_inner("RSA i15",
900 &br_rsa_i15_public, &br_rsa_i15_private, &br_rsa_i15_keygen);
901 }
902
903 static void
904 test_speed_rsa_i31(void)
905 {
906 test_speed_rsa_inner("RSA i31",
907 &br_rsa_i31_public, &br_rsa_i31_private, &br_rsa_i31_keygen);
908 }
909
910 static void
911 test_speed_rsa_i32(void)
912 {
913 test_speed_rsa_inner("RSA i32",
914 &br_rsa_i32_public, &br_rsa_i32_private, 0);
915 }
916
917 static void
918 test_speed_rsa_i62(void)
919 {
920 br_rsa_public pub;
921 br_rsa_private priv;
922 br_rsa_keygen kgen;
923
924 pub = br_rsa_i62_public_get();
925 priv = br_rsa_i62_private_get();
926 kgen = br_rsa_i62_keygen_get();
927 if (pub) {
928 test_speed_rsa_inner("RSA i62", pub, priv, kgen);
929 } else {
930 printf("%-30s UNAVAILABLE\n", "RSA i62");
931 }
932 }
933
934 static void
935 test_speed_ec_inner_1(const char *name,
936 const br_ec_impl *impl, const br_ec_curve_def *cd)
937 {
938 unsigned char bx[80], U[160];
939 uint32_t x[22], n[22];
940 size_t nlen, ulen;
941 int i;
942 long num;
943
944 nlen = cd->order_len;
945 br_i31_decode(n, cd->order, nlen);
946 memset(bx, 'T', sizeof bx);
947 br_i31_decode_reduce(x, bx, sizeof bx, n);
948 br_i31_encode(bx, nlen, x);
949 ulen = cd->generator_len;
950 memcpy(U, cd->generator, ulen);
951 for (i = 0; i < 10; i ++) {
952 impl->mul(U, ulen, bx, nlen, cd->curve);
953 }
954 num = 10;
955 for (;;) {
956 clock_t begin, end;
957 double tt;
958 long k;
959
960 begin = clock();
961 for (k = num; k > 0; k --) {
962 impl->mul(U, ulen, bx, nlen, cd->curve);
963 }
964 end = clock();
965 tt = (double)(end - begin) / CLOCKS_PER_SEC;
966 if (tt >= 2.0) {
967 printf("%-30s %8.2f mul/s\n", name,
968 (double)num / tt);
969 fflush(stdout);
970 break;
971 }
972 num <<= 1;
973 }
974 }
975
976 static void
977 test_speed_ec_inner_2(const char *name,
978 const br_ec_impl *impl, const br_ec_curve_def *cd)
979 {
980 unsigned char bx[80], U[160];
981 uint32_t x[22], n[22];
982 size_t nlen;
983 int i;
984 long num;
985
986 nlen = cd->order_len;
987 br_i31_decode(n, cd->order, nlen);
988 memset(bx, 'T', sizeof bx);
989 br_i31_decode_reduce(x, bx, sizeof bx, n);
990 br_i31_encode(bx, nlen, x);
991 for (i = 0; i < 10; i ++) {
992 impl->mulgen(U, bx, nlen, cd->curve);
993 }
994 num = 10;
995 for (;;) {
996 clock_t begin, end;
997 double tt;
998 long k;
999
1000 begin = clock();
1001 for (k = num; k > 0; k --) {
1002 impl->mulgen(U, bx, nlen, cd->curve);
1003 }
1004 end = clock();
1005 tt = (double)(end - begin) / CLOCKS_PER_SEC;
1006 if (tt >= 2.0) {
1007 printf("%-30s %8.2f mul/s\n", name,
1008 (double)num / tt);
1009 fflush(stdout);
1010 break;
1011 }
1012 num <<= 1;
1013 }
1014 }
1015
1016 static void
1017 test_speed_ec_inner(const char *name,
1018 const br_ec_impl *impl, const br_ec_curve_def *cd)
1019 {
1020 char tmp[50];
1021
1022 test_speed_ec_inner_1(name, impl, cd);
1023 sprintf(tmp, "%s (FP)", name);
1024 test_speed_ec_inner_2(tmp, impl, cd);
1025 }
1026
1027 static void
1028 test_speed_ec_p256_m15(void)
1029 {
1030 test_speed_ec_inner("EC p256_m15",
1031 &br_ec_p256_m15, &br_secp256r1);
1032 }
1033
1034 static void
1035 test_speed_ec_p256_m31(void)
1036 {
1037 test_speed_ec_inner("EC p256_m31",
1038 &br_ec_p256_m31, &br_secp256r1);
1039 }
1040
1041 static void
1042 test_speed_ec_prime_i15(void)
1043 {
1044 test_speed_ec_inner("EC prime_i15 P-256",
1045 &br_ec_prime_i15, &br_secp256r1);
1046 test_speed_ec_inner("EC prime_i15 P-384",
1047 &br_ec_prime_i15, &br_secp384r1);
1048 test_speed_ec_inner("EC prime_i15 P-521",
1049 &br_ec_prime_i15, &br_secp521r1);
1050 }
1051
1052 static void
1053 test_speed_ec_prime_i31(void)
1054 {
1055 test_speed_ec_inner("EC prime_i31 P-256",
1056 &br_ec_prime_i31, &br_secp256r1);
1057 test_speed_ec_inner("EC prime_i31 P-384",
1058 &br_ec_prime_i31, &br_secp384r1);
1059 test_speed_ec_inner("EC prime_i31 P-521",
1060 &br_ec_prime_i31, &br_secp521r1);
1061 }
1062
1063 static void
1064 test_speed_ec_c25519_i15(void)
1065 {
1066 test_speed_ec_inner("EC c25519_i15",
1067 &br_ec_c25519_i15, &br_curve25519);
1068 }
1069
1070 static void
1071 test_speed_ec_c25519_i31(void)
1072 {
1073 test_speed_ec_inner("EC c25519_i31",
1074 &br_ec_c25519_i31, &br_curve25519);
1075 }
1076
1077 static void
1078 test_speed_ec_c25519_m15(void)
1079 {
1080 test_speed_ec_inner("EC c25519_m15",
1081 &br_ec_c25519_m15, &br_curve25519);
1082 }
1083
1084 static void
1085 test_speed_ec_c25519_m31(void)
1086 {
1087 test_speed_ec_inner("EC c25519_m31",
1088 &br_ec_c25519_m31, &br_curve25519);
1089 }
1090
1091 static void
1092 test_speed_ecdsa_inner(const char *name,
1093 const br_ec_impl *impl, const br_ec_curve_def *cd,
1094 br_ecdsa_sign sign, br_ecdsa_vrfy vrfy)
1095 {
1096 unsigned char bx[80], U[160], hv[32], sig[160];
1097 uint32_t x[22], n[22];
1098 size_t nlen, ulen, sig_len;
1099 int i;
1100 long num;
1101 br_ec_private_key sk;
1102 br_ec_public_key pk;
1103
1104 nlen = cd->order_len;
1105 br_i31_decode(n, cd->order, nlen);
1106 memset(bx, 'T', sizeof bx);
1107 br_i31_decode_reduce(x, bx, sizeof bx, n);
1108 br_i31_encode(bx, nlen, x);
1109 ulen = cd->generator_len;
1110 memcpy(U, cd->generator, ulen);
1111 impl->mul(U, ulen, bx, nlen, cd->curve);
1112 sk.curve = cd->curve;
1113 sk.x = bx;
1114 sk.xlen = nlen;
1115 pk.curve = cd->curve;
1116 pk.q = U;
1117 pk.qlen = ulen;
1118
1119 memset(hv, 'H', sizeof hv);
1120 sig_len = sign(impl, &br_sha256_vtable, hv, &sk, sig);
1121 if (vrfy(impl, hv, sizeof hv, &pk, sig, sig_len) != 1) {
1122 fprintf(stderr, "self-test sign/verify failed\n");
1123 exit(EXIT_FAILURE);
1124 }
1125
1126 for (i = 0; i < 10; i ++) {
1127 hv[1] ++;
1128 sign(impl, &br_sha256_vtable, hv, &sk, sig);
1129 vrfy(impl, hv, sizeof hv, &pk, sig, sig_len);
1130 }
1131
1132 num = 10;
1133 for (;;) {
1134 clock_t begin, end;
1135 double tt;
1136 long k;
1137
1138 begin = clock();
1139 for (k = num; k > 0; k --) {
1140 hv[1] ++;
1141 sig_len = sign(impl, &br_sha256_vtable, hv, &sk, sig);
1142 }
1143 end = clock();
1144 tt = (double)(end - begin) / CLOCKS_PER_SEC;
1145 if (tt >= 2.0) {
1146 printf("%-30s %8.2f sign/s\n", name,
1147 (double)num / tt);
1148 fflush(stdout);
1149 break;
1150 }
1151 num <<= 1;
1152 }
1153
1154 num = 10;
1155 for (;;) {
1156 clock_t begin, end;
1157 double tt;
1158 long k;
1159
1160 begin = clock();
1161 for (k = num; k > 0; k --) {
1162 vrfy(impl, hv, sizeof hv, &pk, sig, sig_len);
1163 }
1164 end = clock();
1165 tt = (double)(end - begin) / CLOCKS_PER_SEC;
1166 if (tt >= 2.0) {
1167 printf("%-30s %8.2f verify/s\n", name,
1168 (double)num / tt);
1169 fflush(stdout);
1170 break;
1171 }
1172 num <<= 1;
1173 }
1174 }
1175
1176 static void
1177 test_speed_ecdsa_p256_m15(void)
1178 {
1179 test_speed_ecdsa_inner("ECDSA m15 P-256",
1180 &br_ec_p256_m15, &br_secp256r1,
1181 &br_ecdsa_i15_sign_asn1,
1182 &br_ecdsa_i15_vrfy_asn1);
1183 }
1184
1185 static void
1186 test_speed_ecdsa_p256_m31(void)
1187 {
1188 test_speed_ecdsa_inner("ECDSA m31 P-256",
1189 &br_ec_p256_m31, &br_secp256r1,
1190 &br_ecdsa_i31_sign_asn1,
1191 &br_ecdsa_i31_vrfy_asn1);
1192 }
1193
1194 static void
1195 test_speed_ecdsa_i15(void)
1196 {
1197 test_speed_ecdsa_inner("ECDSA i15 P-256",
1198 &br_ec_prime_i15, &br_secp256r1,
1199 &br_ecdsa_i15_sign_asn1,
1200 &br_ecdsa_i15_vrfy_asn1);
1201 test_speed_ecdsa_inner("ECDSA i15 P-384",
1202 &br_ec_prime_i15, &br_secp384r1,
1203 &br_ecdsa_i15_sign_asn1,
1204 &br_ecdsa_i15_vrfy_asn1);
1205 test_speed_ecdsa_inner("ECDSA i15 P-521",
1206 &br_ec_prime_i15, &br_secp521r1,
1207 &br_ecdsa_i15_sign_asn1,
1208 &br_ecdsa_i15_vrfy_asn1);
1209 }
1210
1211 static void
1212 test_speed_ecdsa_i31(void)
1213 {
1214 test_speed_ecdsa_inner("ECDSA i31 P-256",
1215 &br_ec_prime_i31, &br_secp256r1,
1216 &br_ecdsa_i31_sign_asn1,
1217 &br_ecdsa_i31_vrfy_asn1);
1218 test_speed_ecdsa_inner("ECDSA i31 P-384",
1219 &br_ec_prime_i31, &br_secp384r1,
1220 &br_ecdsa_i31_sign_asn1,
1221 &br_ecdsa_i31_vrfy_asn1);
1222 test_speed_ecdsa_inner("ECDSA i31 P-521",
1223 &br_ec_prime_i31, &br_secp521r1,
1224 &br_ecdsa_i31_sign_asn1,
1225 &br_ecdsa_i31_vrfy_asn1);
1226 }
1227
1228 static void
1229 test_speed_i31(void)
1230 {
1231 static const unsigned char bp[] = {
1232 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00,
1233 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
1234 0xBC, 0xE6, 0xFA, 0xAD, 0xA7, 0x17, 0x9E, 0x84,
1235 0xF3, 0xB9, 0xCA, 0xC2, 0xFC, 0x63, 0x25, 0x51
1236 };
1237
1238 unsigned char tmp[60 + sizeof bp];
1239 uint32_t p[10], x[10], y[10], z[10], uu[30], p0i;
1240 int i;
1241 long num;
1242
1243 br_i31_decode(p, bp, sizeof bp);
1244 p0i = br_i31_ninv31(p[1]);
1245 memset(tmp, 'T', sizeof tmp);
1246 br_i31_decode_reduce(x, tmp, sizeof tmp, p);
1247 memset(tmp, 'U', sizeof tmp);
1248 br_i31_decode_reduce(y, tmp, sizeof tmp, p);
1249
1250 for (i = 0; i < 10; i ++) {
1251 br_i31_to_monty(x, p);
1252 }
1253 num = 10;
1254 for (;;) {
1255 clock_t begin, end;
1256 double tt;
1257 long k;
1258
1259 begin = clock();
1260 for (k = num; k > 0; k --) {
1261 br_i31_to_monty(x, p);
1262 }
1263 end = clock();
1264 tt = (double)(end - begin) / CLOCKS_PER_SEC;
1265 if (tt >= 2.0) {
1266 printf("%-30s %8.2f ops/s\n", "i31 to_monty",
1267 (double)num / tt);
1268 fflush(stdout);
1269 break;
1270 }
1271 num <<= 1;
1272 }
1273
1274 for (i = 0; i < 10; i ++) {
1275 br_i31_from_monty(x, p, p0i);
1276 }
1277 num = 10;
1278 for (;;) {
1279 clock_t begin, end;
1280 double tt;
1281 long k;
1282
1283 begin = clock();
1284 for (k = num; k > 0; k --) {
1285 br_i31_from_monty(x, p, p0i);
1286 }
1287 end = clock();
1288 tt = (double)(end - begin) / CLOCKS_PER_SEC;
1289 if (tt >= 2.0) {
1290 printf("%-30s %8.2f ops/s\n", "i31 from_monty",
1291 (double)num / tt);
1292 fflush(stdout);
1293 break;
1294 }
1295 num <<= 1;
1296 }
1297
1298 for (i = 0; i < 10; i ++) {
1299 br_i31_montymul(z, x, y, p, p0i);
1300 }
1301 num = 10;
1302 for (;;) {
1303 clock_t begin, end;
1304 double tt;
1305 long k;
1306
1307 begin = clock();
1308 for (k = num; k > 0; k --) {
1309 br_i31_montymul(z, x, y, p, p0i);
1310 }
1311 end = clock();
1312 tt = (double)(end - begin) / CLOCKS_PER_SEC;
1313 if (tt >= 2.0) {
1314 printf("%-30s %8.2f ops/s\n", "i31 montymul",
1315 (double)num / tt);
1316 fflush(stdout);
1317 break;
1318 }
1319 num <<= 1;
1320 }
1321
1322 for (i = 0; i < 10; i ++) {
1323 br_i31_moddiv(x, y, p, p0i, uu);
1324 }
1325 num = 10;
1326 for (;;) {
1327 clock_t begin, end;
1328 double tt;
1329 long k;
1330
1331 begin = clock();
1332 for (k = num; k > 0; k --) {
1333 br_i31_moddiv(x, y, p, p0i, uu);
1334 }
1335 end = clock();
1336 tt = (double)(end - begin) / CLOCKS_PER_SEC;
1337 if (tt >= 2.0) {
1338 printf("%-30s %8.2f ops/s\n", "i31 moddiv",
1339 (double)num / tt);
1340 fflush(stdout);
1341 break;
1342 }
1343 num <<= 1;
1344 }
1345 }
1346
1347 #if 0
1348
1349 static unsigned char P2048[] = {
1350 0xFD, 0xB6, 0xE0, 0x3E, 0x00, 0x49, 0x4C, 0xF0, 0x69, 0x3A, 0xDD, 0x7D,
1351 0xF8, 0xA2, 0x41, 0xB0, 0x6C, 0x67, 0xC5, 0xBA, 0xB8, 0x46, 0x80, 0xF5,
1352 0xBF, 0xAB, 0x98, 0xFC, 0x84, 0x73, 0xA5, 0x63, 0xC9, 0x52, 0x12, 0xDA,
1353 0x4C, 0xC1, 0x5B, 0x9D, 0x8D, 0xDF, 0xCD, 0xFE, 0xC5, 0xAD, 0x5A, 0x6F,
1354 0xDD, 0x02, 0xD9, 0xEC, 0x71, 0xEF, 0xEB, 0xB6, 0x95, 0xED, 0x94, 0x25,
1355 0x0E, 0x63, 0xDD, 0x6A, 0x52, 0xC7, 0x93, 0xAF, 0x85, 0x9D, 0x2C, 0xBE,
1356 0x5C, 0xBE, 0x35, 0xD8, 0xDD, 0x39, 0xEF, 0x1B, 0xB1, 0x49, 0x67, 0xB2,
1357 0x33, 0xC9, 0x7C, 0xE1, 0x51, 0x79, 0x51, 0x59, 0xCA, 0x6E, 0x2A, 0xDF,
1358 0x0D, 0x76, 0x1C, 0xE7, 0xA5, 0xC0, 0x1E, 0x6C, 0x56, 0x3A, 0x32, 0xE5,
1359 0xB5, 0xC5, 0xD4, 0xDB, 0xFE, 0xFF, 0xF8, 0xF2, 0x96, 0xA9, 0xC9, 0x65,
1360 0x59, 0x9E, 0x01, 0x79, 0x9D, 0x38, 0x68, 0x0F, 0xAD, 0x43, 0x3A, 0xD6,
1361 0x84, 0x0A, 0xE2, 0xEF, 0x96, 0xC1, 0x6D, 0x89, 0x74, 0x19, 0x63, 0x82,
1362 0x3B, 0xA0, 0x9C, 0xBA, 0x78, 0xDE, 0xDC, 0xC2, 0xE7, 0xD4, 0xFA, 0xD6,
1363 0x19, 0x21, 0x29, 0xAE, 0x5E, 0xF4, 0x38, 0x81, 0xC6, 0x9E, 0x0E, 0x3C,
1364 0xCD, 0xC0, 0xDC, 0x93, 0x5D, 0xFD, 0x9A, 0x5C, 0xAB, 0x54, 0x1F, 0xFF,
1365 0x9C, 0x12, 0x1B, 0x4C, 0xDF, 0x2D, 0x9C, 0x85, 0xF9, 0x68, 0x15, 0x89,
1366 0x42, 0x9B, 0x6C, 0x45, 0x89, 0x3A, 0xBC, 0xE9, 0x19, 0x91, 0xBE, 0x0C,
1367 0xEF, 0x90, 0xCC, 0xF6, 0xD6, 0xF0, 0x3D, 0x5C, 0xF5, 0xE5, 0x0F, 0x2F,
1368 0x02, 0x8A, 0x83, 0x4B, 0x93, 0x2F, 0x14, 0x12, 0x1F, 0x56, 0x9A, 0x12,
1369 0x58, 0x88, 0xAE, 0x60, 0xB8, 0x5A, 0xE4, 0xA1, 0xBF, 0x4A, 0x81, 0x84,
1370 0xAB, 0xBB, 0xE4, 0xD0, 0x1D, 0x41, 0xD9, 0x0A, 0xAB, 0x1E, 0x47, 0x5B,
1371 0x31, 0xAC, 0x2B, 0x73
1372 };
1373
1374 static unsigned char G2048[] = {
1375 0x02
1376 };
1377
1378 static void
1379 test_speed_modpow(void)
1380 {
1381 uint32_t mx[65], mp[65], me[65], t1[65], t2[65], len;
1382 unsigned char e[64];
1383 int i;
1384 long num;
1385
1386 len = br_int_decode(mp, sizeof mp / sizeof mp[0],
1387 P2048, sizeof P2048);
1388 if (len != 65) {
1389 abort();
1390 }
1391 memset(e, 'P', sizeof e);
1392 if (!br_int_decode(me, sizeof me / sizeof me[0], e, sizeof e)) {
1393 abort();
1394 }
1395 if (!br_modint_decode(mx, mp, G2048, sizeof G2048)) {
1396 abort();
1397 }
1398 for (i = 0; i < 10; i ++) {
1399 br_modint_to_monty(mx, mp);
1400 br_modint_montypow(mx, me, mp, t1, t2);
1401 br_modint_from_monty(mx, mp);
1402 }
1403 num = 10;
1404 for (;;) {
1405 clock_t begin, end;
1406 double tt;
1407 long k;
1408
1409 begin = clock();
1410 for (k = num; k > 0; k --) {
1411 br_modint_to_monty(mx, mp);
1412 br_modint_montypow(mx, me, mp, t1, t2);
1413 br_modint_from_monty(mx, mp);
1414 }
1415 end = clock();
1416 tt = (double)(end - begin) / CLOCKS_PER_SEC;
1417 if (tt >= 2.0) {
1418 printf("%-30s %8.2f exp/s\n", "pow[2048:256]",
1419 (double)num / tt);
1420 fflush(stdout);
1421 return;
1422 }
1423 num <<= 1;
1424 }
1425 }
1426
1427 static void
1428 test_speed_moddiv(void)
1429 {
1430 uint32_t mx[65], my[65], mp[65], t1[65], t2[65], t3[65], len;
1431 unsigned char x[255], y[255];
1432 int i;
1433 long num;
1434
1435 len = br_int_decode(mp, sizeof mp / sizeof mp[0],
1436 P2048, sizeof P2048);
1437 if (len != 65) {
1438 abort();
1439 }
1440 memset(x, 'T', sizeof x);
1441 memset(y, 'P', sizeof y);
1442 if (!br_modint_decode(mx, mp, x, sizeof x)) {
1443 abort();
1444 }
1445 if (!br_modint_decode(my, mp, y, sizeof y)) {
1446 abort();
1447 }
1448 for (i = 0; i < 10; i ++) {
1449 br_modint_div(mx, my, mp, t1, t2, t3);
1450 }
1451 num = 10;
1452 for (;;) {
1453 clock_t begin, end;
1454 double tt;
1455 long k;
1456
1457 begin = clock();
1458 for (k = num; k > 0; k --) {
1459 br_modint_div(mx, my, mp, t1, t2, t3);
1460 }
1461 end = clock();
1462 tt = (double)(end - begin) / CLOCKS_PER_SEC;
1463 if (tt >= 2.0) {
1464 printf("%-30s %8.2f div/s\n", "div[2048]",
1465 (double)num / tt);
1466 fflush(stdout);
1467 return;
1468 }
1469 num <<= 1;
1470 }
1471 }
1472 #endif
1473
1474 #define STU(x) { test_speed_ ## x, #x }
1475
1476 static const struct {
1477 void (*fn)(void);
1478 char *name;
1479 } tfns[] = {
1480 STU(md5),
1481 STU(sha1),
1482 STU(sha256),
1483 STU(sha512),
1484
1485 STU(aes128_big_cbcenc),
1486 STU(aes128_big_cbcdec),
1487 STU(aes192_big_cbcenc),
1488 STU(aes192_big_cbcdec),
1489 STU(aes256_big_cbcenc),
1490 STU(aes256_big_cbcdec),
1491 STU(aes128_big_ctr),
1492 STU(aes192_big_ctr),
1493 STU(aes256_big_ctr),
1494
1495 STU(aes128_small_cbcenc),
1496 STU(aes128_small_cbcdec),
1497 STU(aes192_small_cbcenc),
1498 STU(aes192_small_cbcdec),
1499 STU(aes256_small_cbcenc),
1500 STU(aes256_small_cbcdec),
1501 STU(aes128_small_ctr),
1502 STU(aes192_small_ctr),
1503 STU(aes256_small_ctr),
1504
1505 STU(aes128_ct_cbcenc),
1506 STU(aes128_ct_cbcdec),
1507 STU(aes192_ct_cbcenc),
1508 STU(aes192_ct_cbcdec),
1509 STU(aes256_ct_cbcenc),
1510 STU(aes256_ct_cbcdec),
1511 STU(aes128_ct_ctr),
1512 STU(aes192_ct_ctr),
1513 STU(aes256_ct_ctr),
1514
1515 STU(aes128_ct64_cbcenc),
1516 STU(aes128_ct64_cbcdec),
1517 STU(aes192_ct64_cbcenc),
1518 STU(aes192_ct64_cbcdec),
1519 STU(aes256_ct64_cbcenc),
1520 STU(aes256_ct64_cbcdec),
1521 STU(aes128_ct64_ctr),
1522 STU(aes192_ct64_ctr),
1523 STU(aes256_ct64_ctr),
1524
1525 STU(aes128_x86ni_cbcenc),
1526 STU(aes128_x86ni_cbcdec),
1527 STU(aes192_x86ni_cbcenc),
1528 STU(aes192_x86ni_cbcdec),
1529 STU(aes256_x86ni_cbcenc),
1530 STU(aes256_x86ni_cbcdec),
1531 STU(aes128_x86ni_ctr),
1532 STU(aes192_x86ni_ctr),
1533 STU(aes256_x86ni_ctr),
1534
1535 STU(aes128_pwr8_cbcenc),
1536 STU(aes128_pwr8_cbcdec),
1537 STU(aes192_pwr8_cbcenc),
1538 STU(aes192_pwr8_cbcdec),
1539 STU(aes256_pwr8_cbcenc),
1540 STU(aes256_pwr8_cbcdec),
1541 STU(aes128_pwr8_ctr),
1542 STU(aes192_pwr8_ctr),
1543 STU(aes256_pwr8_ctr),
1544
1545 STU(des_tab_cbcenc),
1546 STU(des_tab_cbcdec),
1547 STU(3des_tab_cbcenc),
1548 STU(3des_tab_cbcdec),
1549
1550 STU(des_ct_cbcenc),
1551 STU(des_ct_cbcdec),
1552 STU(3des_ct_cbcenc),
1553 STU(3des_ct_cbcdec),
1554
1555 STU(chacha20_ct),
1556 STU(chacha20_sse2),
1557
1558 STU(ghash_ctmul),
1559 STU(ghash_ctmul32),
1560 STU(ghash_ctmul64),
1561 STU(ghash_pclmul),
1562 STU(ghash_pwr8),
1563
1564 STU(poly1305_ctmul),
1565 STU(poly1305_ctmul32),
1566 STU(poly1305_ctmulq),
1567 STU(poly1305_i15),
1568
1569 STU(eax_aes128_big),
1570 STU(eax_aes192_big),
1571 STU(eax_aes256_big),
1572 STU(eax_aes128_small),
1573 STU(eax_aes192_small),
1574 STU(eax_aes256_small),
1575 STU(eax_aes128_ct),
1576 STU(eax_aes192_ct),
1577 STU(eax_aes256_ct),
1578 STU(eax_aes128_ct64),
1579 STU(eax_aes192_ct64),
1580 STU(eax_aes256_ct64),
1581 STU(eax_aes128_x86ni),
1582 STU(eax_aes192_x86ni),
1583 STU(eax_aes256_x86ni),
1584 STU(eax_aes128_pwr8),
1585 STU(eax_aes192_pwr8),
1586 STU(eax_aes256_pwr8),
1587
1588 STU(shake128),
1589 STU(shake256),
1590
1591 STU(rsa_i15),
1592 STU(rsa_i31),
1593 STU(rsa_i32),
1594 STU(rsa_i62),
1595 STU(ec_prime_i15),
1596 STU(ec_prime_i31),
1597 STU(ec_p256_m15),
1598 STU(ec_p256_m31),
1599 STU(ec_c25519_i15),
1600 STU(ec_c25519_i31),
1601 STU(ec_c25519_m15),
1602 STU(ec_c25519_m31),
1603 STU(ecdsa_p256_m15),
1604 STU(ecdsa_p256_m31),
1605 STU(ecdsa_i15),
1606 STU(ecdsa_i31),
1607
1608 STU(i31)
1609 };
1610
1611 static int
1612 eq_name(const char *s1, const char *s2)
1613 {
1614 for (;;) {
1615 int c1, c2;
1616
1617 for (;;) {
1618 c1 = *s1 ++;
1619 if (c1 >= 'A' && c1 <= 'Z') {
1620 c1 += 'a' - 'A';
1621 } else {
1622 switch (c1) {
1623 case '-': case '_': case '.': case ' ':
1624 continue;
1625 }
1626 }
1627 break;
1628 }
1629 for (;;) {
1630 c2 = *s2 ++;
1631 if (c2 >= 'A' && c2 <= 'Z') {
1632 c2 += 'a' - 'A';
1633 } else {
1634 switch (c2) {
1635 case '-': case '_': case '.': case ' ':
1636 continue;
1637 }
1638 }
1639 break;
1640 }
1641 if (c1 != c2) {
1642 return 0;
1643 }
1644 if (c1 == 0) {
1645 return 1;
1646 }
1647 }
1648 }
1649
1650 int
1651 main(int argc, char *argv[])
1652 {
1653 size_t u;
1654
1655 if (argc <= 1) {
1656 printf("usage: testspeed all | name...\n");
1657 printf("individual test names:\n");
1658 for (u = 0; u < (sizeof tfns) / (sizeof tfns[0]); u ++) {
1659 printf(" %s\n", tfns[u].name);
1660 }
1661 } else {
1662 for (u = 0; u < (sizeof tfns) / (sizeof tfns[0]); u ++) {
1663 int i;
1664
1665 for (i = 1; i < argc; i ++) {
1666 if (eq_name(argv[i], tfns[u].name)
1667 || eq_name(argv[i], "all"))
1668 {
1669 tfns[u].fn();
1670 break;
1671 }
1672 }
1673 }
1674 }
1675 return 0;
1676 }
The BearSSL library and tools.